Consumer Health Data Privacy Policy

1. About this policy

This Consumer Health Data Privacy Policy describes how MDChat collects, uses, shares, and protects consumer health data. It supplements our Privacy Policy and applies in addition to it. We provide this policy to comply with Washington’s My Health My Data Act (MHMDA), Nevada’s SB370, and similar consumer-health-data laws in other states. Where this policy and the general Privacy Policy differ on the treatment of consumer health data, this policy controls for that data.

2. What “consumer health data” means

“Consumer health data” is defined broadly under these laws. It means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For MDChat, this includes, for example:

• The symptoms, conditions, history, and questions you share in the chat, and the informational assessment we generate from them.
• The fact that you sought, or are seeking, health-care services or a clinician.
• A health condition, treatment, or medication you browsed, asked about, or started an intake for.
• Information that identifies your attempt to acquire health services or supplies, and data derived or inferred from any of the above.

Consumer health data does not include de-identified or aggregated data that cannot reasonably be linked back to you.

3. What we collect and why

We collect consumer health data only to provide the service you ask for and to operate it safely. Specifically, we use it to:

• Conduct the AI symptom intake and generate an informational triage assessment for you.
• Connect you, when appropriate and with your consent, to clinicians licensed to provide care, and to coordinate that care.
• Operate, secure, and improve the service (for example, fraud prevention and quality and safety review, using de-identified or aggregated data where possible).
• Comply with our legal obligations.

We practice data minimization: we collect the consumer health data needed for these purposes and no more. MDChat provides informational assessments only — it is not a doctor and does not provide medical advice.

4. The firewall: we never sell it or share it with advertisers

Your consumer health data is protected by a strict health-data firewall:

• We do not sell your consumer health data.
• We never use it for advertising, never share it with advertising platforms, and never use it to target ads to you. We do not place advertising pixels on the chat, intake, assessment, account, or clinical pages.
• We do not sell, share, or rent your phone number or SMS-consent information to third parties for their own marketing.

We share consumer health data only with the limited categories of recipients needed to deliver the care and service you ask for, under contracts that we require to include appropriate safeguards and restrict their use of the data to our instructions (and, where PHI is involved, a Business Associate Agreement, which we are working to put in place). Those categories are:

• Clinician / medical-group partners — the licensed clinicians and the professional entity who review your information and provide care, when you choose to connect with care.
• Service providers / processors — vendors who process data on our behalf, such as cloud hosting, the AI providers that host the underlying models, identity verification, payment processing, and secure messaging.
• Pharmacies and labs — when they are part of the care you authorize.
• Legal and safety recipients — when required by law, or to prevent serious harm to you or others.

This is a list of categories, not a promise that any specific vendor is or is not engaged at a given time. You can request the specific list of third parties and affiliates we have shared your consumer health data with (see §5).

5. Your rights

Under MHMDA and similar laws, you have the right to:

• Access the consumer health data we have collected about you, and confirm whether we are collecting, sharing, or selling it.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data, subject to records we are required to retain by law (for example, certain medical or prescription records tied to a clinician visit).
• Receive a list of the third parties and affiliates with whom we have shared your consumer health data.

To exercise any of these rights, email privacy@mdchat.com and tell us which right you are exercising and the email address and/or phone number associated with your use of MDChat. We may need to verify your identity before completing certain requests, and we will not discriminate against you for exercising your rights.

6. Right to appeal

If we decline your request, we will explain why. You then have the right to appeal that decision by replying to our response or emailing privacy@mdchat.com with the word “appeal.” We will review the appeal and inform you in writing of our decision and the reasons for it. If your appeal is denied, you may contact your state attorney general to submit a complaint.

7. No geofencing around health-care facilities

We do not use geofencing to establish a virtual boundary around any in-person health-care facility, and we do not use any such technology to identify, track, collect data from, or send notifications to consumers based on their proximity to a health-care facility.

8. How we protect consumer health data

We apply administrative, technical, and physical safeguards — including encryption in transit and at rest, access controls, and monitoring — to protect consumer health data. Access is limited to the people and processors who need it to provide the service. No method of transmission or storage is 100% secure, and we will notify you of a breach as required by law.

9. Related choices

Because we never share consumer health data with advertisers, there is no advertising opt-out to perform for that data — the protection applies automatically. Separately, you can manage the “sale” or “sharing” of online advertising and analytics identifiers (such as cookies, device IDs, or IP address) on our Your Privacy Choices page. For the full picture of what we collect and how we use it, see our Privacy Policy.

10. Contact us

MDChat Inc. — 8 The Green, Ste. A, Dover, DE 19901
Consumer health data requests and questions: privacy@mdchat.com